YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_CRIME_RAT_WIN_PE_Godrat_Aug25

Detects GodRAT malware targeting Windows systems

MalwareGodRATSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Arda Buyukkaya
Date: 2025-08-23
Modified: 2026-05-15
Score / Quality: 75 / 83

What this rule detects

Detects GodRAT malware targeting Windows systems

Associated malware family: GodRAT.

Targets: Windows PE.

It defines 9 patterns (1 text, 8 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

mal-crime-rat-win-pe-godrat-aug25.yarDetection Rule License 1.1

import "pe"

rule SIGNATURE_BASE_MAL_CRIME_RAT_WIN_PE_Godrat_Aug25 : GODRAT RAT WINDOWS GH0ST_RAT GETGOD FILE
{
	meta:
		description = "Detects GodRAT malware targeting Windows systems"
		author = "Arda Buyukkaya"
		id = "e6ec0af5-71d3-520a-a671-8634ac2f926f"
		date = "2025-08-23"
		modified = "2026-05-15"
		reference = "https://securelist.com/godrat/117119/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_win_pe_godrat_aug25.yar#L4-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "154e800ed1719dbdcb188c00d5822444717c2a89017f2d12b8511eeeda0c2f41"
		logic_hash = "eda3175277bbf9f6408f5d2dd25d6780552aad4104fe62bb92125c734f9fdd98"
		score = 75
		quality = 83
		tags = "GODRAT, RAT, WINDOWS, GH0ST RAT, GETGOD, FILE"
		family = "GodRAT"
		victims = "Financial services"

	strings:
		$winrt_txt = "C++/WinRT version" ascii wide nocase
		$api_blob = {
         4E 74 43 72 65 61 74 65 53 65 63 74 69 6F 6E 00                          // NtCreateSection
         4E 74 4D 61 70 56 69 65 77 4F 66 53 65 63 74 69 6F 6E 00 00              // NtMapViewOfSection
         4E 74 55 6E 6D 61 70 56 69 65 77 4F 66 53 65 63 74 69 6F 6E 00 00 00 00  // NtUnmapViewOfSection
      }
		$ld_movups = { 0F 10 05 ?? ?? ?? ?? }
		$ld_movq = { F3 0F 7E 05 ?? ?? ?? ?? }
		$st_movups = { 0F 11 85 ?? ?? ?? ?? }
		$st_movq = { 66 0F D6 85 ?? ?? ?? ?? }
		$scan_loop = { 8A 01 41 84 C0 75 F9 }
		$cmp_len_770 = { 81 FF 70 07 00 00 0F 82 ?? ?? ?? ?? }
		$cmp_len_76C = { 81 FF 6C 07 00 00 0F 82 ?? ?? ?? ?? }

	condition:
		pe.is_pe and filesize <= 10MB and ( ( $winrt_txt and ( pe.imphash ( ) == "0f4b0270c84616ce594b6a84c47a7717" ) ) or ( ( $ld_movups or $ld_movq ) and ( ( #st_movups >= 2 ) or ( #st_movq >= 2 ) or ( #st_movups >= 1 and #st_movq >= 1 ) ) and $scan_loop and $api_blob and ( $cmp_len_770 or $cmp_len_76C ) ) or pe.imphash ( ) == "ee5ea868d8233000216e7b29bc8cb4e2" )
}

Strings (9 patterns)

Identifier	Type	Value	Modifiers
$winrt_txt	text	"C++/WinRT version"	ascii wide nocase
$api_blob	hex	{ 4E 74 43 72 65 61 74 65 53 65 63 74 69 6F 6E 00 // NtCreateSection 4E 74 4D 61 70 56 69 65 77 4F 66 53 65 63 74 69 …
$ld_movups	hex	{ 0F 10 05 ?? ?? ?? ?? }
$ld_movq	hex	{ F3 0F 7E 05 ?? ?? ?? ?? }
$st_movups	hex	{ 0F 11 85 ?? ?? ?? ?? }
$st_movq	hex	{ 66 0F D6 85 ?? ?? ?? ?? }
$scan_loop	hex	{ 8A 01 41 84 C0 75 F9 }
$cmp_len_770	hex	{ 81 FF 70 07 00 00 0F 82 ?? ?? ?? ?? }
$cmp_len_76C	hex	{ 81 FF 6C 07 00 00 0F 82 ?? ?? ?? ?? }

Condition

pe.is_pe and filesize <= 10MB and ( ( $winrt_txt and ( pe.imphash ( ) == "0f4b0270c84616ce594b6a84c47a7717" ) ) or ( ( $ld_movups or $ld_movq ) and ( ( #st_movups >= 2 ) or ( #st_movq >= 2 ) or ( #st_movups >= 1 and #st_movq >= 1 ) ) and $scan_loop and $api_blob and ( $cmp_len_770 or $cmp_len_76C ) ) or pe.imphash ( ) == "ee5ea868d8233000216e7b29bc8cb4e2" )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 10MB (a cheap guard that skips large files).
Pattern $st_movups must occur >= 2 times.
Pattern $st_movq must occur >= 2 times.
Pattern $st_movups must occur >= 1 times.
Pattern $st_movq must occur >= 1 times.
Uses the pe module.
Pattern $winrt_txt must be present.
Pattern $ld_movups must be present.
Pattern $ld_movq must be present.
Pattern $scan_loop must be present.
Pattern $api_blob must be present.
Pattern $cmp_len_770 must be present.
Pattern $cmp_len_76C must be present.
Checks the PE import hash (imphash).

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://securelist.com/godrat/117119/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

154e800ed1719dbdcb188c00d5822444717c2a89017f2d12b8511eeeda0c2f41

Licence & attribution

Author: Arda Buyukkaya

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e6ec0af5-71d3-520a-a671-8634ac2f926f

Metadata

family	GodRAT
victims	Financial services

Tags:GODRAT RAT WINDOWS GH0ST_RAT GETGOD FILE

SIGNATURE_BASE_MAL_BACKORDER_LOADER_WIN_Go_Jan23
MalwareSignature Base (Florian Roth / Nextron)· Arda Buyukkaya (modified by Florian Roth)· 2025-01-23